mrakdev/anti-debug-collection

My anti debugging collection in csharp

Anti Debug Collection

This repository contains a collection of anti-debugging tricks that I have collected in C#.

Methods

Flags

• IsDebuggerPresent
• IsRemoteDebugPresent
• ProcessDebugPortFlag
• ProcessDebugObjectHandleFlag

Manual Flags

• PEB
• NtGlobalFlag

Misc

• ParentProcess
• RaiseException
• HideThreadsFromDebugger
• Timer

Hooks

• HeavenGate (detect ScyllaHide)
• IsBadHookNumberObject (detect ScyllaHide)

Syscall

• NtQueryInformationProcess (detect ScyllaHide)

Object Handles

• CloseHandle

Reference and Credits

• Anti-Debug Tricks
• Ahora57
• Trollicus

anti-debug-collection's Issues

CloseHandleTrick always return true in x86

Describe the bug
CloseHandleTrick is always true on x86, even without any debugger.

To Reproduce
Steps to reproduce the behavior:
Compile the app in x86 and run.

Expected behavior
Return false when not debugging, and true when debugging